`security-crypto` deprecation

[piercifani]

If I'm not mistaken, this package is powered under the hood by security-crypto; but it looks like Google has deprecated it. What should we do?

[marcprux]

That is correct. In fact, they are soft deprecating the entire SharedPreferences API.

Since these APIs have been available since forever and are in active use by thousands of apps, they will certainly be stable for a very long time to come. But thinking about the future is probably a good idea. Their vague recommendation for replacing SharedPreferences is to migrate to DataStore, but that's like replacing a scalpel with a machete. If you wanted to do that, you could just store your app's encrypted preferences using SkipSQLPlus with encryption enabled (but that begs the question: where to securely store the key itself? Maybe in the Android Keystore?)

We're open to suggestions about where to go in the future, and whether it would involve going into a future release of skip-keychain itself (likely as a major version bump), or justify creating a new separate package to handle encrypted preferences.

I personally feel like this deprecation was hasty and poorly-considered and has led to a lot of confusion and consternation. I think the important take-away is that these APIs will continue to work fine for many years to come, since breaking backwards compatibility would break a huge number of apps (tantamount to a scenario where Apple whimsically decides to deprecate their UserDefaults or Keychain APIs, which will never happen).